@coderifts/agent-guard 8.5.0 → 9.0.0

package/dist/esm/deploy-gate.js

@@ -4,9 +4,12 @@
  * receipt and the observed pipeline-enforcement state?"
  *
  * Same shape as the merge gate, different operation. It is a PURE function — NO I/O, NO CD-API call
- * (pipeline enforcement is an INPUT, observed by the host and passed in). It does NOT re-decide: it
- * reads only the finished receipt fields — the deterministic verdict stays the server's (D7). Same
- * inputs → same output (D9).
+ * (pipeline enforcement is an INPUT, observed by the host and passed in). TOKEN mode verifies a
+ * chain-receipt locally (Ed25519 + registry/pinned PEM; no HTTP). VERIFIED-VIEW mode accepts a
+ * host-attributed view ONLY with the guard-defined provenance marker. A bare
+ * `currently_authorized: true` is not proof (P0 / external audit 2026-08-24). Same
+ * inputs → same output (D9). Observation `verification.{mode,verify_status}` is recorded on the
+ * outcome; it does not enter any fingerprint preimage.
  *
  * The three deploy-specific binds are the whole point: T7 (a MERGE — or operation-less — receipt can
  * never deploy), environment binding (a staging ALLOW never authorizes production), and artifact
@@ -18,6 +21,27 @@
  * generic deploy-gate concepts — no scoring logic, weights, thresholds, pattern names, endpoints, or
  * secrets.
  */
+import { verifyDeployReceiptToken, } from './deploy-receipt-token.js';
+/**
+ * Guard-defined VERIFIED-VIEW provenance marker (same idiom as `proof_spec` /
+ * `attestation_spec`). A host that already verified (CLI, etc.) MUST set this —
+ * `currently_authorized: true` alone is untrusted input.
+ */
+export const DEPLOY_RECEIPT_VIEW_SPEC = 'deploy-receipt-view.v1';
+/** Stamp a computed view so deployGate will accept it as VERIFIED-VIEW (not TOKEN). */
+export function asVerifiedDeployReceiptView(view, verify_status = 'VERIFIED_CURRENT') {
+    return {
+        ...view,
+        view_spec: DEPLOY_RECEIPT_VIEW_SPEC,
+        verified: true,
+        verify_status,
+    };
+}
+export function isVerifiedDeployReceiptView(r) {
+    return !!r
+        && r.view_spec === DEPLOY_RECEIPT_VIEW_SPEC
+        && r.verified === true;
+}
 // ── helpers (pure) ────────────────────────────────────────────────────────────────────────────────
 function norm(s) {
     return String(s == null ? '' : s).trim().toLowerCase();
@@ -70,29 +94,62 @@ export function deployGate(input) {
     const allowPending = input.allowPending ?? rc.allowPending ?? false;
     const allowWarnDeploy = input.allowWarnDeploy ?? rc.allowWarnDeploy ?? false;
     const allowPrefix = input.allowPrefixCompare ?? rc.allowPrefixCompare ?? false;
-    const receipt = input.receipt;
-    const detail = {
+    let verification = { mode: 'none', verify_status: null };
+    let receipt = input.receipt;
+    const detailOf = (r) => ({
         environment: norm(target.environment),
         artifact_id: norm(target.artifact_id),
-        bound_environment: receipt && receipt.bound_environment != null ? norm(receipt.bound_environment) : null,
-        bound_artifact_id: receipt && receipt.bound_artifact_id != null ? norm(receipt.bound_artifact_id) : null,
-        operation: receipt && receipt.operation != null ? String(receipt.operation) : null,
-    };
+        bound_environment: r && r.bound_environment != null ? norm(r.bound_environment) : null,
+        bound_artifact_id: r && r.bound_artifact_id != null ? norm(r.bound_artifact_id) : null,
+        operation: r && r.operation != null ? String(r.operation) : null,
+    });
     const deny = (state, reason) => ({
         deploy_allowed: false, state, reason, enforcement_state, inescapable_deploy: false,
         residuals: [],
-        detail,
+        detail: detailOf(receipt),
+        verification,
     });
     // 0) incomplete target → pending/failure (fail-closed on missing evaluation input).
     if (!target.environment || String(target.environment).trim() === ''
         || !target.artifact_id || String(target.artifact_id).trim() === '') {
         return deny(allowPending ? 'pending' : 'failure', 'inputs_incomplete');
     }
-    // 1) no receipt → fail-closed (D4).
+    // TOKEN mode (recommended): guard verifies locally. Wins over a sibling receipt view.
+    const tokenInput = input.token;
+    if (tokenInput && typeof tokenInput.token === 'string' && tokenInput.token.length > 0) {
+        const tv = verifyDeployReceiptToken(tokenInput, {
+            operation: opRequired,
+            environment: target.environment,
+            artifact_id: target.artifact_id,
+        });
+        verification = { mode: 'token', verify_status: tv.status };
+        if (tv.denyReason) {
+            receipt = tv.view;
+            return deny('failure', tv.denyReason);
+        }
+        receipt = tv.view;
+    }
+    else if (receipt === null || receipt === undefined) {
+        // 1) no receipt and no token → fail-closed (D4).
+        return deny(allowPending ? 'pending' : 'failure', 'no_receipt');
+    }
+    else if (isVerifiedDeployReceiptView(receipt)) {
+        verification = {
+            mode: 'verified_view',
+            verify_status: typeof receipt.verify_status === 'string' ? receipt.verify_status : null,
+        };
+    }
+    else {
+        // Bare currently_authorized (or any view without the guard-defined marker).
+        verification = { mode: 'unverified', verify_status: null };
+        return deny('failure', 'unverified_receipt_view');
+    }
     if (receipt === null || receipt === undefined) {
         return deny(allowPending ? 'pending' : 'failure', 'no_receipt');
     }
     // 2) lifecycle authorization — a valid signature alone is NOT sufficient (D5).
+    //    In TOKEN mode currently_authorized was COMPUTED; in VERIFIED-VIEW it is host-attributed
+    //    behind view_spec (not a sneaked boolean).
     if (receipt.currently_authorized !== true) {
         return deny('failure', 'receipt_not_authorized');
     }
@@ -165,7 +222,8 @@ export function deployGate(input) {
         inescapable_deploy,
         residuals,
         ...(residual ? { residual } : {}),
-        detail,
+        detail: detailOf(receipt),
+        verification,
     };
 }
 //# sourceMappingURL=deploy-gate.js.map

package/dist/esm/deploy-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAwHH,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,uCAAuC;IACvI,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,uCAAuC;IACvI,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,OAAO,IAAI,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACxG,iBAAiB,EAAE,OAAO,IAAI,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACxG,SAAS,EAAE,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACnF,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE,CAAC,CAAC;QACtF,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK;QAClF,SAAS,EAAE,EAAE;QACb,MAAM;KACP,CAAC,CAAC;IAEH,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IACD,oCAAoC;IACpC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IACD,+EAA+E;IAC/E,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,kGAAkG;IAClG,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,aAAa,IAAI,OAAO,CAAC;IAEpD,mEAAmE;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;;YAChE,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EACL,wBAAwB,GAEzB,MAAM,2BAA2B,CAAC;AAKnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAiC,CAAC;AAqF1E,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CACzC,IAAuB,EACvB,aAAa,GAAG,kBAAkB;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,wBAAwB;QACnC,QAAQ,EAAE,IAAI;QACd,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,CAAuC;IACjF,OAAO,CAAC,CAAC,CAAC;WACL,CAAC,CAAC,SAAS,KAAK,wBAAwB;WACxC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AA0ED,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,uCAAuC;IACvI,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,uCAAuC;IACvI,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE/E,IAAI,YAAY,GAAkC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,OAAO,GAAyC,KAAK,CAAC,OAAO,CAAC;IAElE,MAAM,QAAQ,GAAG,CAAC,CAAuC,EAAE,EAAE,CAAC,CAAC;QAC7D,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACjE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE,CAAC,CAAC;QACtF,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK;QAClF,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC,CAAC;IAEH,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,sFAAsF;IACtF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,EAAE,GAAG,wBAAwB,CAAC,UAAU,EAAE;YAC9C,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,UAA8B,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,iDAAiD;QACjD,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,YAAY,GAAG;YACb,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;SACxF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,YAAY,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,+EAA+E;IAC/E,6FAA6F;IAC7F,+CAA+C;IAC/C,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,kGAAkG;IAClG,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,aAAa,IAAI,OAAO,CAAC;IAEpD,mEAAmE;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;;YAChE,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/esm/deploy-receipt-token.d.ts

@@ -0,0 +1,59 @@
+/**
+ * TOKEN-mode chain-receipt verification for deployGate.
+ *
+ * SDK 3.4.0 `CodeRifts.verifyReceipt` is HTTP POST /api/v1/verify-receipt (async, I/O) —
+ * unusable inside the pure deployGate. Local public-material verify of crchain.v1 is
+ * NOT exported by that SDK. This module:
+ *   - uses node:crypto Ed25519 the same way `@coderifts/sdk` `verifyExecutionAttestation` does
+ *     (`createPublicKey` + `verify`) — no new algorithm
+ *   - reuses SDK `ExecutorKeyRegistry` shape and `isReceiptExpired` (ID104 leeway)
+ *   - reuses this package's `computeBodyHash` for envelope bind
+ *   - reconstructs the published crchain.v1 signing input (RECEIPT_FORMAT / app kernel)
+ *
+ * No fetch. Same inputs → same output.
+ */
+import type { ExecutorKeyRegistry } from '@coderifts/sdk';
+/** Structural receipt view produced after TOKEN verify (assignable to DeployReceiptView). */
+export type TokenDerivedReceiptView = {
+    currently_authorized: boolean;
+    decision: string;
+    execution_action?: string;
+    operation?: string;
+    bound_environment?: string | null;
+    bound_artifact_id?: string | null;
+    verdict_fingerprint?: string;
+    body_hash?: string;
+    target_id?: string;
+};
+export declare const CHAIN_SIGNING_PREFIX = "crchain.v1";
+export type DeployTokenReceipt = {
+    /** Signed chain_receipt token (`base64url(body).base64url(sig)`). */
+    token: string;
+    /** Body-hash-bound decision envelope (verifier family). Required for currently_authorized. */
+    decision_result?: Record<string, unknown>;
+    /** Well-known-shaped registry `{ keys: [{ kid, public_key_pem, status, valid_from, retired_at }] }`. */
+    registry?: ExecutorKeyRegistry;
+    /** Air-gap single PEM (kid-agnostic). */
+    pinnedKeyPem?: string;
+};
+export type DeployTokenVerifyStatus = 'VERIFIED_CURRENT' | 'VERIFIED_EXPIRED' | 'RETIRED_KEY_VALID_AT_ISSUE' | 'INVALID_SIGNATURE' | 'MALFORMED' | 'UNKNOWN_KEY' | 'UNSUPPORTED_VERSION';
+export type DeployTokenVerifyResult = {
+    valid: boolean;
+    status: DeployTokenVerifyStatus;
+    currently_authorized: boolean;
+    authz_reason: string | null;
+    /** When set, deployGate denies with this reason before bind checks. */
+    denyReason: string | null;
+    payload?: Record<string, unknown>;
+    view: TokenDerivedReceiptView | null;
+    key_status: 'active' | 'retired' | null;
+};
+/**
+ * Verify a chain-receipt token against a registry or pinned PEM. Pure (no I/O).
+ */
+export declare function verifyDeployReceiptToken(input: DeployTokenReceipt, _intended?: {
+    operation?: string;
+    environment?: string;
+    artifact_id?: string;
+}, nowMs?: number): DeployTokenVerifyResult;
+//# sourceMappingURL=deploy-receipt-token.d.ts.map

package/dist/esm/deploy-receipt-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-receipt-token.d.ts","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,kBAAkB,GAClB,4BAA4B,GAC5B,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,qBAAqB,CAAC;AAE1B,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC;CACzC,CAAC;AA+GF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,EACzB,SAAS,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,EAClF,KAAK,CAAC,EAAE,MAAM,GACb,uBAAuB,CA2HzB"}

package/dist/esm/deploy-receipt-token.js

@@ -0,0 +1,241 @@
+/**
+ * TOKEN-mode chain-receipt verification for deployGate.
+ *
+ * SDK 3.4.0 `CodeRifts.verifyReceipt` is HTTP POST /api/v1/verify-receipt (async, I/O) —
+ * unusable inside the pure deployGate. Local public-material verify of crchain.v1 is
+ * NOT exported by that SDK. This module:
+ *   - uses node:crypto Ed25519 the same way `@coderifts/sdk` `verifyExecutionAttestation` does
+ *     (`createPublicKey` + `verify`) — no new algorithm
+ *   - reuses SDK `ExecutorKeyRegistry` shape and `isReceiptExpired` (ID104 leeway)
+ *   - reuses this package's `computeBodyHash` for envelope bind
+ *   - reconstructs the published crchain.v1 signing input (RECEIPT_FORMAT / app kernel)
+ *
+ * No fetch. Same inputs → same output.
+ */
+import { createPublicKey, verify as cryptoVerify } from 'node:crypto';
+import { isReceiptExpired } from '@coderifts/sdk';
+import { computeBodyHash } from './receipt-binding.js';
+export const CHAIN_SIGNING_PREFIX = 'crchain.v1';
+function scalar(v) {
+    return v == null ? '' : String(v);
+}
+function reconstructInput(payload) {
+    const v1 = `${CHAIN_SIGNING_PREFIX}|${scalar(payload.kid)}|${scalar(payload.fp)}|${scalar(payload.prev)}|${scalar(payload.caller)}|${scalar(payload.ts)}`;
+    if (payload.v === 4) {
+        return `${v1}|${scalar(payload.reg)}|${scalar(payload.ir)}|${scalar(payload.expires_at)}|${scalar(payload.bh)}`;
+    }
+    if (payload.v === 3) {
+        return `${v1}|${scalar(payload.reg)}|${scalar(payload.ir)}`;
+    }
+    if (payload.v === 2) {
+        return `${v1}|${scalar(payload.reg)}`;
+    }
+    return v1;
+}
+function isIssueTimeWithinKeyWindow(ts, keyMeta) {
+    if (!keyMeta || keyMeta.status === 'active')
+        return true;
+    if (keyMeta.status !== 'retired')
+        return false;
+    if (typeof keyMeta.retired_at !== 'string' || keyMeta.retired_at.length === 0)
+        return false;
+    if (typeof ts !== 'string' || ts.length === 0)
+        return false;
+    const issueMs = Date.parse(ts);
+    if (!Number.isFinite(issueMs))
+        return false;
+    if (keyMeta.valid_from) {
+        const fromMs = Date.parse(keyMeta.valid_from);
+        if (Number.isFinite(fromMs) && issueMs < fromMs)
+            return false;
+    }
+    const retiredMs = Date.parse(keyMeta.retired_at);
+    if (!Number.isFinite(retiredMs))
+        return false;
+    if (issueMs >= retiredMs)
+        return false;
+    return true;
+}
+function resolveKey(kid, registry, pinnedKeyPem) {
+    if (typeof pinnedKeyPem === 'string' && pinnedKeyPem.trim().length > 0) {
+        try {
+            return {
+                publicKey: createPublicKey(pinnedKeyPem),
+                status: 'active',
+                valid_from: null,
+                retired_at: null,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!registry || !Array.isArray(registry.keys) || !kid)
+        return null;
+    const matches = registry.keys.filter((k) => k && k.kid === kid && typeof k.public_key_pem === 'string');
+    if (matches.length === 0)
+        return null;
+    const entry = matches.find((k) => k.status === 'active') || matches[0];
+    try {
+        return {
+            publicKey: createPublicKey(entry.public_key_pem),
+            status: entry.status === 'retired' ? 'retired' : 'active',
+            valid_from: entry.valid_from || null,
+            retired_at: entry.retired_at || null,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function fail(status, denyReason, extra = {}) {
+    return {
+        valid: false,
+        status,
+        currently_authorized: false,
+        authz_reason: extra.authz_reason ?? denyReason,
+        denyReason,
+        view: null,
+        key_status: extra.key_status ?? null,
+        payload: extra.payload,
+    };
+}
+function viewFromEnvelope(envelope, payload, currently_authorized) {
+    const artifact = envelope.target_id ?? envelope.artifact_digest ?? envelope.bound_artifact_id;
+    return {
+        currently_authorized,
+        decision: typeof envelope.decision === 'string' ? envelope.decision : '',
+        execution_action: typeof envelope.execution_action === 'string' ? envelope.execution_action : undefined,
+        operation: typeof envelope.operation === 'string' ? envelope.operation : undefined,
+        bound_environment: typeof envelope.environment === 'string' ? envelope.environment : null,
+        bound_artifact_id: artifact == null ? null : String(artifact),
+        verdict_fingerprint: typeof envelope.fingerprint === 'string'
+            ? envelope.fingerprint
+            : (typeof payload.fp === 'string' ? payload.fp : undefined),
+        body_hash: typeof payload.bh === 'string' ? payload.bh : undefined,
+        target_id: envelope.target_id == null ? undefined : String(envelope.target_id),
+    };
+}
+/**
+ * Verify a chain-receipt token against a registry or pinned PEM. Pure (no I/O).
+ */
+export function verifyDeployReceiptToken(input, _intended = {}, nowMs) {
+    const token = input && input.token;
+    if (typeof token !== 'string' || token.length === 0) {
+        return fail('MALFORMED', 'unverified_receipt_view');
+    }
+    const hasKeys = (input.pinnedKeyPem && String(input.pinnedKeyPem).trim().length > 0)
+        || (input.registry && Array.isArray(input.registry.keys) && input.registry.keys.length > 0);
+    if (!hasKeys) {
+        return fail('MALFORMED', 'inputs_incomplete', { authz_reason: 'keys_missing' });
+    }
+    const segments = token.split('.');
+    if (segments.length !== 2 || segments.some((s) => !s)) {
+        return fail('MALFORMED', 'unverified_receipt_view');
+    }
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(segments[0], 'base64url').toString('utf8'));
+    }
+    catch {
+        return fail('MALFORMED', 'unverified_receipt_view');
+    }
+    if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+        return fail('MALFORMED', 'unverified_receipt_view');
+    }
+    if (typeof payload.v === 'number' && payload.v > 4) {
+        return fail('UNSUPPORTED_VERSION', 'unverified_receipt_view', { payload });
+    }
+    const kid = typeof payload.kid === 'string' ? payload.kid : '';
+    const resolved = resolveKey(kid, input.registry, input.pinnedKeyPem);
+    if (!resolved)
+        return fail('UNKNOWN_KEY', 'unknown_key', { payload });
+    let sigOk = false;
+    try {
+        sigOk = cryptoVerify(null, Buffer.from(reconstructInput(payload), 'utf8'), resolved.publicKey, Buffer.from(segments[1], 'base64url'));
+    }
+    catch {
+        return fail('INVALID_SIGNATURE', 'invalid_signature', { payload });
+    }
+    if (!sigOk)
+        return fail('INVALID_SIGNATURE', 'invalid_signature', { payload });
+    for (const k of ['kid', 'fp', 'prev', 'caller', 'ts', 'reg', 'ir', 'expires_at', 'bh']) {
+        if (typeof payload[k] === 'string' && payload[k].includes('|')) {
+            return fail('INVALID_SIGNATURE', 'invalid_signature', { payload, authz_reason: 'delimiter_in_field' });
+        }
+    }
+    if (resolved.status === 'retired') {
+        if (!isIssueTimeWithinKeyWindow(typeof payload.ts === 'string' ? payload.ts : undefined, resolved)) {
+            return fail('INVALID_SIGNATURE', 'invalid_signature', { payload, authz_reason: 'retired_key_outside_window' });
+        }
+        const envelope = input.decision_result && typeof input.decision_result === 'object'
+            ? input.decision_result
+            : undefined;
+        const view = envelope ? viewFromEnvelope(envelope, payload, false) : null;
+        return {
+            valid: true,
+            status: 'RETIRED_KEY_VALID_AT_ISSUE',
+            currently_authorized: false,
+            authz_reason: 'retired_key',
+            denyReason: 'retired_key',
+            payload,
+            view,
+            key_status: 'retired',
+        };
+    }
+    if (payload.v === 4 && typeof payload.expires_at === 'string') {
+        const exp = Date.parse(payload.expires_at);
+        const now = Number.isFinite(nowMs) ? nowMs : Date.now();
+        if (isReceiptExpired(exp, now, { environment: _intended.environment, operation: _intended.operation })) {
+            const envelope = input.decision_result && typeof input.decision_result === 'object'
+                ? input.decision_result
+                : undefined;
+            return {
+                valid: true,
+                status: 'VERIFIED_EXPIRED',
+                currently_authorized: false,
+                authz_reason: 'expired',
+                denyReason: 'expired',
+                payload,
+                view: envelope ? viewFromEnvelope(envelope, payload, false) : null,
+                key_status: 'active',
+            };
+        }
+    }
+    const envelope = input.decision_result && typeof input.decision_result === 'object'
+        ? input.decision_result
+        : undefined;
+    if (!envelope) {
+        return {
+            valid: true,
+            status: 'VERIFIED_CURRENT',
+            currently_authorized: false,
+            authz_reason: 'receipt_context_required',
+            denyReason: 'receipt_not_authorized',
+            payload,
+            view: null,
+            key_status: 'active',
+        };
+    }
+    let localBh = null;
+    try {
+        localBh = computeBodyHash(envelope);
+    }
+    catch {
+        localBh = null;
+    }
+    if (typeof payload.bh !== 'string' || payload.bh !== localBh) {
+        return fail('INVALID_SIGNATURE', 'body_hash_mismatch', { payload, authz_reason: 'body_hash_mismatch' });
+    }
+    return {
+        valid: true,
+        status: 'VERIFIED_CURRENT',
+        currently_authorized: true,
+        authz_reason: 'ok',
+        denyReason: null,
+        payload,
+        view: viewFromEnvelope(envelope, payload, true),
+        key_status: 'active',
+    };
+}
+//# sourceMappingURL=deploy-receipt-token.js.map

package/dist/esm/deploy-receipt-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-receipt-token.js","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAevD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAkCjD,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,EAAE,GAAG,GAAG,oBAAoB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1J,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,0BAA0B,CACjC,EAAsB,EACtB,OAAiF;IAEjF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,QAAyC,EACzC,YAAgC;IAEhC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,eAAe,CAAC,YAAY,CAAC;gBACxC,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO;YACL,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC;YAChD,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACzD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;SACrC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CACX,MAA+B,EAC/B,UAAkB,EAClB,QAA0C,EAAE;IAE5C,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,oBAAoB,EAAE,KAAK;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,UAAU;QAC9C,UAAU;QACV,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAiC,EACjC,OAAgC,EAChC,oBAA6B;IAE7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,iBAAiB,CAAC;IAC9F,OAAO;QACL,oBAAoB;QACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QACxE,gBAAgB,EAAE,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACvG,SAAS,EAAE,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAClF,iBAAiB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACzF,iBAAiB,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7D,mBAAmB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YAC3D,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,SAAS,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAyB,EACzB,YAAgF,EAAE,EAClF,KAAc;IAEd,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;WAC/E,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAClB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAC9C,QAAQ,CAAC,SAAS,EAClB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/E,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACvF,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,OAAO,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,0BAA0B,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YACjF,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,4BAA4B;YACpC,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,aAAa;YACzB,OAAO;YACP,IAAI;YACJ,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpE,IAAI,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACvG,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;gBACjF,CAAC,CAAC,KAAK,CAAC,eAAe;gBACvB,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,kBAAkB;gBAC1B,oBAAoB,EAAE,KAAK;gBAC3B,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,SAAS;gBACrB,OAAO;gBACP,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;gBAClE,UAAU,EAAE,QAAQ;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;QACjF,CAAC,CAAC,KAAK,CAAC,eAAe;QACvB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,kBAAkB;YAC1B,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,0BAA0B;YACxC,UAAU,EAAE,wBAAwB;YACpC,OAAO;YACP,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QAAC,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACtE,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,kBAAkB;QAC1B,oBAAoB,EAAE,IAAI;QAC1B,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,OAAO;QACP,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;QAC/C,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC"}

package/dist/esm/index.d.ts

@@ -64,8 +64,10 @@ export { guardToolRegistry, RegistryConstructionError } from './tool-registry.js
 export type { RawTool, ProtectedTool, ToolMutationClass, EnforcementCoverage, RegistryCoverageReport, GuardToolRegistryConfig, RegistryResult, ToolBinder, RegistryConstructionErrorCode, } from './tool-registry.js';
 export { gateDecision } from './merge-gate.js';
 export type { GateDecisionInput, GateDecision, ReceiptView, RequiredContext, ProtectionState, GateReason, GateStatusState, EnforcementState, } from './merge-gate.js';
-export { deployGate } from './deploy-gate.js';
-export type { DeployGateInput, DeployGateDecision, DeployReceiptView, DeployRequiredContext, DeployEnforcementState, DeployTarget, DeployGateReason, } from './deploy-gate.js';
+export { deployGate, asVerifiedDeployReceiptView, isVerifiedDeployReceiptView, DEPLOY_RECEIPT_VIEW_SPEC, } from './deploy-gate.js';
+export type { DeployGateInput, DeployGateDecision, DeployReceiptView, VerifiedDeployReceiptView, DeployRequiredContext, DeployEnforcementState, DeployTarget, DeployGateReason, DeployTokenReceipt, DeployVerificationObservation, DeployVerificationMode, } from './deploy-gate.js';
+export { verifyDeployReceiptToken } from './deploy-receipt-token.js';
+export type { DeployTokenVerifyResult, DeployTokenVerifyStatus } from './deploy-receipt-token.js';
 export { bindDeploy, DEPLOY_REPAIRABLE_REASONS } from './deploy-bind.js';
 export type { BindDeployInput, BindDeployResult, HostAssertedEnvironment, } from './deploy-bind.js';
 export { coverageReport } from './coverage-report.js';

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,kCAAkC,EAClC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,iCAAiC,EACjC,+BAA+B,EAC/B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE7E,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,4BAA4B,EAC5B,aAAa,EACb,QAAQ,EACR,kCAAkC,GACnC,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAC1B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,6BAA6B,EAC7B,iCAAiC,EACjC,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,EACX,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,EACnB,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,gBAAgB,EAChB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,EAChB,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACjG,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAC7E,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,GACvD,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EACV,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,GAC3D,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAClF,eAAe,EAAE,cAAc,EAAE,eAAe,EAChD,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,GACxF,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,oBAAoB,EAChH,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,2BAA2B,EAC5E,mBAAmB,EAAE,uBAAuB,GAC7C,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,kCAAkC,EAClC,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,yBAAyB,EACzB,UAAU,EACV,yBAAyB,EACzB,sBAAsB,EACtB,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,kCAAkC,EAClC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,iCAAiC,EACjC,+BAA+B,EAC/B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE7E,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,4BAA4B,EAC5B,aAAa,EACb,QAAQ,EACR,kCAAkC,GACnC,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAC1B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,6BAA6B,EAC7B,iCAAiC,EACjC,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,EACX,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,EACnB,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,gBAAgB,EAChB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,EAChB,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACjG,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,UAAU,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,yBAAyB,EACjF,qBAAqB,EAAE,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,EAC7E,kBAAkB,EAAE,6BAA6B,EAAE,sBAAsB,GAC1E,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,YAAY,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAElG,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EACV,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,GAC3D,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAClF,eAAe,EAAE,cAAc,EAAE,eAAe,EAChD,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,GACxF,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,oBAAoB,EAChH,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,2BAA2B,EAC5E,mBAAmB,EAAE,uBAAuB,GAC7C,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,kCAAkC,EAClC,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,yBAAyB,EACzB,UAAU,EACV,yBAAyB,EACzB,sBAAsB,EACtB,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC"}

package/dist/esm/index.js

@@ -73,7 +73,8 @@ export { guardToolRegistry, RegistryConstructionError } from './tool-registry.js
 // repo-merge-gate (#7) — the PURE repo-side merge decision (Placement B). No I/O; protection is input.
 export { gateDecision } from './merge-gate.js';
 // deploy-gate (#8) — the PURE deploy authorization decision. No I/O; pipeline enforcement is input.
-export { deployGate } from './deploy-gate.js';
+export { deployGate, asVerifiedDeployReceiptView, isVerifiedDeployReceiptView, DEPLOY_RECEIPT_VIEW_SPEC, } from './deploy-gate.js';
+export { verifyDeployReceiptToken } from './deploy-receipt-token.js';
 // bindDeploy — pure deploy-TIME caller over deployGate (host asserts env; pipeline action not observed).
 export { bindDeploy, DEPLOY_REPAIRABLE_REASONS } from './deploy-bind.js';
 // enforcement-coverage report (#9) — the PURE tetrad aggregator. No I/O; reads the primitives' states.

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,2FAA2F;AAC3F,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE7F,wGAAwG;AACxG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAK5B,sGAAsG;AACtG,+DAA+D;AAC/D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE1G,uFAAuF;AACvF,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,kCAAkC,EAClC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AAOzC,+FAA+F;AAC/F,gGAAgG;AAChG,mFAAmF;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,+FAA+F;AAC/F,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAiC5B,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE7E,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,4BAA4B,EAC5B,aAAa,EACb,QAAQ,EACR,kCAAkC,GACnC,MAAM,0BAA0B,CAAC;AAWlC,8FAA8F;AAC9F,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,2FAA2F;AAC3F,sFAAsF;AACtF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAQjC,mGAAmG;AACnG,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAexB,0GAA0G;AAC1G,2FAA2F;AAC3F,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAWhC,yGAAyG;AACzG,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,sFAAsF;AACtF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,EACX,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAO/B,uGAAuG;AACvG,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAO9B,mFAAmF;AACnF,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AAOpC,4FAA4F;AAC5F,yFAAyF;AACzF,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,EACnB,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAW9B,+FAA+F;AAC/F,0FAA0F;AAC1F,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,EAChB,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAO3C,kGAAkG;AAClG,wFAAwF;AACxF,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAKjG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7D,qGAAqG;AACrG,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAalF,uGAAuG;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAM/C,oGAAoG;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAK9C,yGAAyG;AACzG,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAKzE,uGAAuG;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAOtD,2EAA2E;AAC3E,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAS3B,oFAAoF;AACpF,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAW1B,gGAAgG;AAChG,qGAAqG;AACrG,2GAA2G;AAC3G,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAO7B,2FAA2F;AAC3F,kEAAkE;AAClE,uFAAuF;AACvF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAS9B,+FAA+F;AAC/F,0FAA0F;AAC1F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AASjC,+FAA+F;AAC/F,0FAA0F;AAC1F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AASjC,8FAA8F;AAC9F,wGAAwG;AACxG,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,kCAAkC,EAClC,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAU9B,2FAA2F;AAC3F,iGAAiG;AACjG,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,GACtB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,2FAA2F;AAC3F,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE7F,wGAAwG;AACxG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAK5B,sGAAsG;AACtG,+DAA+D;AAC/D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE1G,uFAAuF;AACvF,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,kCAAkC,EAClC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AAOzC,+FAA+F;AAC/F,gGAAgG;AAChG,mFAAmF;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,+FAA+F;AAC/F,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAiC5B,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE7E,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,4BAA4B,EAC5B,aAAa,EACb,QAAQ,EACR,kCAAkC,GACnC,MAAM,0BAA0B,CAAC;AAWlC,8FAA8F;AAC9F,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,2FAA2F;AAC3F,sFAAsF;AACtF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAQjC,mGAAmG;AACnG,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAexB,0GAA0G;AAC1G,2FAA2F;AAC3F,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAWhC,yGAAyG;AACzG,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,sFAAsF;AACtF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,EACX,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAO/B,uGAAuG;AACvG,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAO9B,mFAAmF;AACnF,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AAOpC,4FAA4F;AAC5F,yFAAyF;AACzF,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,EACnB,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAW9B,+FAA+F;AAC/F,0FAA0F;AAC1F,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,EAChB,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAO3C,kGAAkG;AAClG,wFAAwF;AACxF,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAKjG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7D,qGAAqG;AACrG,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAalF,uGAAuG;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAM/C,oGAAoG;AACpG,OAAO,EACL,UAAU,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE,yGAAyG;AACzG,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAKzE,uGAAuG;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAOtD,2EAA2E;AAC3E,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAS3B,oFAAoF;AACpF,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAW1B,gGAAgG;AAChG,qGAAqG;AACrG,2GAA2G;AAC3G,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAO7B,2FAA2F;AAC3F,kEAAkE;AAClE,uFAAuF;AACvF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAS9B,+FAA+F;AAC/F,0FAA0F;AAC1F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AASjC,+FAA+F;AAC/F,0FAA0F;AAC1F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AASjC,8FAA8F;AAC9F,wGAAwG;AACxG,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,kCAAkC,EAClC,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAU9B,2FAA2F;AAC3F,iGAAiG;AACjG,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,GACtB,MAAM,wBAAwB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderifts/agent-guard",
-  "version": "8.5.0",
+  "version": "9.0.0",
   "description": "Fail-closed guard for AI agent tool calls — preflight contract changes before they execute. Security core frozen (agent-guard-api v1.0); v1.1 adds client-side enforcement: receipt→envelope binding, decision↔action reconciliation, safe_for_agent + degraded fail-closed, and enforced⟺executed (P0 client-enforcement pack).",
   "main": "./dist/cjs/index.js",
   "module": "./dist/esm/index.js",